🤖 Service Accounts

Sometimes an application inside the cluster needs to talk to Kubernetes itself, for example, to list other pods. The Service Account is the "badge" of the application: it is the identity the pod uses to introduce itself to the cluster. To give access to people, see Users.

Every namespace already comes with a Service Account called default.

info

Service Accounts are created with kubectl. The Nuvion Panel does not have a screen for this feature.

---

🚀 Before you start

• Have cluster access configured (see Cluster Access).

🚀 1. List the Service Accounts

kubectl get serviceaccounts

You will see at least default.

🚀 2. Create a Service Account

kubectl create serviceaccount app-sa

Expected output: serviceaccount/app-sa created

🚀 3. Verify

kubectl describe serviceaccount app-sa

🚀 4. Use the Service Account in a pod

Create the file pod-sa.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-sa
spec:
  serviceAccountName: app-sa
  containers:
    - name: app
      image: busybox
      command: ["sh", "-c", "sleep 3600"]

kubectl apply -f pod-sa.yaml
kubectl exec pod-sa -- ls /var/run/secrets/kubernetes.io/serviceaccount

Expected output: ca.crt namespace token. These files are the pod's identity, delivered automatically by Kubernetes.

🚀 5. Generate a token (for use outside the cluster)

kubectl create token app-sa --duration=1h

The command shows a temporary token, valid for 1 hour.

warning

The token is a credential. Do not share or publish this value.

✅ How to know it worked

The ls from step 4 shows the three files, and step 5 returns a long text (the token).

🔒 Best practices

• Create a Service Account per application, instead of using default for everything.
• A new Service Account has no permissions. Grant only what is needed, using Roles and RBAC.
• If the application does not need to talk to the cluster, disable the token by adding automountServiceAccountToken: false in the pod's spec section.

❗ Common problems

Symptom	Cause	Solution
Pod is not created and mentions serviceaccount not found	Service Account name is wrong or in another namespace	Check with kubectl get serviceaccounts
Forbidden when using the token	The Service Account does not have permissions yet	Follow the Roles and RBAC pages
unknown command "token"	Old kubectl	Update kubectl (version 1.24 or higher)

🧹 Cleanup

kubectl delete pod pod-sa
kubectl delete serviceaccount app-sa

➡️ Next step: Roles

🧠 Questions?

Talk to our SaveinCloud technical support team!